Administrator cannot encrypt/decrypt in AWS KMS

3
votes

I am using the Key Management service (KMS) in AWS and am currently setting up key policies.

I created two roles KmsUser and KmsAdmin and attached the following key policy to my CMK:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KMS KeyAdmin access",
      "Effect": "Allow",
      "Principal": {"AWS": [
          "arn:aws:iam::1234567890:role/KmsAdmin",
      "arn:aws:iam::1234567890:user/myadmin"
      ]},
      "Action": [
        "kms:Create*",
        "kms:Describe*",
        "kms:Enable*",
        "kms:List*",
        "kms:Put*",
        "kms:Update*",
        "kms:Revoke*",
        "kms:Disable*",
        "kms:Get*",
        "kms:Delete*",
        "kms:TagResource",
        "kms:UntagResource",
        "kms:ScheduleKeyDeletion",
        "kms:CancelKeyDeletion"
      ],
    "Resource": "*"
    },
    {
      "Sid": "KMS KeyUser access",
      "Effect": "Allow",
      "Principal": {"AWS": [
          "arn:aws:iam::1234567890:role/KmsUser"
      ]},
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

The problem is that now if I try to use my key as the myadmin user (which has the AdministratorAccess policy attached) I get an error in the CLI:

$ aws kms encrypt --key-id "alias/test-key" --plaintext fileb:///tmp/plaintext.dat

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:iam::1234567890:user/myadmin is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-99999999999

What is especially strange, is that the IAM policy simulator tells me that everything should work as expected:

enter image description here

If I manually add the myadmin user as a pricipal to the Key User policy, everything works fine.

2
amazon-web-servicesamazon-iamaws-kmsaws-policies
Actually above policy is for duty segregation. A key administrator is not supposed to be able to encrypt or decrypt data with the key. So admin can manage keys, but cannot access data. Key user can encrypt or decrypt data, but cannot manage keys. So the correct answer was to use KmsUser role to decrypt/encrypt. – lapkritinis

2 Answers

4
votes

You need to add a statement like this to your key policy:

        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }

This allows the account to have access to the key, which is required to enable IAM access to it.

1
votes

If you're creating the KMS construct using AWS CDK then make sure to set the trustAccountIdentities to true. Example in TypeScript

const passwordEncryptionKey = new kms.Key(this, 'MyKey', {
  enabled: true,
  trustAccountIdentities: true,
});

Docs are here